Data processing agreement
This agreement is concluded between the customer named in the Order (the "Controller") and The Branding Brand EOOD, UIC 207195302, g.k. Dianabad 26, 1172 Sofia, Bulgaria, trading as 24/6 (the "Processor"). It forms part of every contract under our terms of service under which the Processor processes personal data on behalf of the Controller (the "Main Contract") and takes effect with it. On request the Processor signs a copy.
1. Subject matter and duration
1.1 The Processor processes personal data on behalf of the Controller to provide the Services under the Main Contract. Nature, purpose, types of data and categories of data subjects are set out in Annex 1.
1.2 This agreement applies for the term of the Main Contract and afterwards for as long as the Processor holds personal data of the Controller.
2. Instructions
2.1 The Processor processes personal data only on documented instructions of the Controller, including with regard to transfers to a third country, unless Union or Member State law to which the Processor is subject requires otherwise; in that case the Processor informs the Controller of that legal requirement before processing, unless the law prohibits this (Art. 28(3)(a)).
2.2 The Main Contract, this agreement and the Controller's use and configuration of the Services are the Controller's complete instructions at the time of conclusion. Further instructions are given in text form.
2.3 The Processor informs the Controller immediately if it considers that an instruction infringes data protection law, and may suspend that instruction until the Controller confirms or changes it.
2.4 The Processor does not use personal data of the Controller for its own purposes, does not sell or share it, and does not use it to train, fine-tune or evaluate AI models, except as permitted in 2.5.
2.5 The Controller permits the Processor to use the personal data, in pseudonymised form, for scientific research on remote work and team coordination, and to publish the results only in anonymised or aggregated form that identifies no person and no organisation (Art. 89 GDPR), and to use meeting content in the same anonymised form in its marketing, for example in LinkedIn posts. For this use the Processor is a separate controller. It keeps research data separate and restricted, does not use special categories of personal data for it, and honours objections of data subjects (Art. 21(6) GDPR). The Controller informs the people concerned of this use, with the text in the Processor's privacy policy (section 3.11). The Controller may withdraw this permission in text form at any time with effect for the future.
3. Confidentiality
The Processor ensures that every person authorised to process the personal data is committed to confidentiality or under an appropriate statutory obligation of confidentiality, and that this obligation continues after the end of their work (Art. 28(3)(b)).
4. Security
4.1 The Processor implements and maintains the technical and organisational measures in Annex 2 (Art. 28(3)(c), Art. 32).
4.2 The measures are subject to technical progress. The Processor may replace them with measures that give at least the same level of protection. It documents material changes and makes the current version available on m246.org/imprint/security.html.
5. Sub-processors
5.1 The Controller gives general authorisation to engage further processors (Art. 28(2)). The sub-processors engaged at the conclusion of this agreement are listed in Annex 3 and are approved.
5.2 The Processor informs the Controller of any intended addition or replacement of a sub-processor at least 30 days in advance by email and by updating Annex 3. The Controller may object in text form within that period on reasonable data protection grounds. If the parties do not agree on a solution, the Controller may terminate the affected Services at the date the change takes effect; fees paid in advance for the period after termination are refunded.
5.3 The Processor imposes on each sub-processor by contract the same data protection obligations as in this agreement, in particular sufficient guarantees for appropriate technical and organisational measures (Art. 28(4)). The Processor remains fully liable to the Controller for the performance of each sub-processor.
5.4 If the Controller has signed a non-disclosure agreement that restricts the tools or AI systems the Processor may use, the Processor uses for that Controller only the tools approved under that agreement.
6. Transfers to third countries
The Processor transfers personal data to a country outside the European Economic Area only where the conditions of Chapter V GDPR are met, in particular on the basis of an adequacy decision such as the EU-U.S. Data Privacy Framework, or of Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 (module 3, processor to processor) concluded with the sub-processor, together with a transfer impact assessment and supplementary measures where required. Annex 3 states the safeguard for each sub-processor.
7. Assistance
7.1 The Processor assists the Controller by appropriate technical and organisational measures in responding to requests of data subjects under Chapter III GDPR (Art. 28(3)(e)). It forwards to the Controller without delay any request it receives directly and does not answer it itself unless instructed.
7.2 The Processor assists the Controller in ensuring compliance with Art. 32 to 36 GDPR, in particular with data protection impact assessments and prior consultations, taking into account the nature of processing and the information available to it (Art. 28(3)(f)).
7.3 The Processor may charge reasonable costs for assistance that goes beyond its own legal duties or is caused by the Controller's fault.
8. Personal data breaches
8.1 The Processor notifies the Controller without undue delay, and at the latest within 72 hours, after becoming aware of a personal data breach affecting the Controller's data (Art. 33(2)).
8.2 The notification contains, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information that is not yet available is provided in phases without further undue delay.
8.3 The Processor takes the measures necessary to secure the data and mitigate adverse effects, and documents every breach.
9. Deletion and return
9.1 At the end of the Services, the Processor at the Controller's choice deletes or returns all personal data of the Controller and deletes existing copies, unless Union or Member State law requires storage (Art. 28(3)(g)).
9.2 Unless the Controller chooses otherwise, the data is available for export for 30 days after the end of the Main Contract and is then deleted. Copies in backups are deleted in the regular backup rotation, at the latest 60 days after the end of the Main Contract; until then they are not restored or used. The Processor confirms deletion in text form on request.
9.3 During the term, the Processor deletes specific data on the Controller's instruction, including where a data subject exercises the right to erasure.
10. Audits and information
10.1 The Processor makes available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, by the Controller or an auditor mandated by it (Art. 28(3)(h)).
10.2 The Controller announces on-site inspections at least 14 days in advance, carries them out during business hours without disrupting operations, and ensures that the auditor is bound to confidentiality and is not a competitor of the Processor. The Processor may first answer by written information, documentation or current certificates where these are sufficient to demonstrate compliance.
11. Liability
Liability towards data subjects is governed by Art. 82 GDPR. Between the parties, the liability provisions of the Main Contract apply.
12. Final provisions
12.1 In the event of conflict, this agreement prevails over the Main Contract in matters of data protection.
12.2 Amendments require text form. Governing law and jurisdiction are as in the Main Contract.
12.3 For Controllers in the United Kingdom, references to the GDPR include the UK GDPR, and transfers are made under the UK International Data Transfer Addendum where required.
Annex 1: Description of the processing
| Nature of processing | Hosting, storage, structuring, display, transmission, transcription, AI-assisted summarising and analysis, and deletion of content in the 24/6 workspace and of meetings the Controller asks us to record. |
| Purpose | Providing the Services under the Main Contract: shared strategy and priorities, tasks with owners and check-in dates, project communication, meeting transcripts and summaries, status reports and alerts, support. |
| Types of personal data | Names, business contact details, roles and team membership; login and usage data; tasks, comments, messages, documents and their metadata; calendar and meeting data; with the Controller's instruction and the data subjects' consent, meeting audio, transcripts and speaker labels; voice profiles only as in the next row. |
| Special categories | Voice profiles for speaker identification are biometric data (Art. 9 GDPR). They are processed only if the Order provides for it and each person concerned has given explicit consent, obtained by the Controller. No other special categories are intended; the Controller does not upload them unless agreed. |
| Data subjects | The Controller's employees, freelancers and other team members; the Controller's customers, partners and other participants of recorded meetings. |
| Location | Primary processing in Germany (netcup) and the EU (Supabase, region eu-north-1; Scaleway, France). Third-country processing only through the sub-processors in Annex 3 and under the safeguards stated there. |
Annex 2: Technical and organisational measures
As published at m246.org/imprint/security.html in the version current at the time.
Annex 3: Sub-processors
As published at m246.org/imprint/subprocessors.html in the version current at the time, subject to section 5.